refactor(auth): drop duplicate extraction tests and narration

The shared lock and session helpers stay. Remove the second copy of
cases already pinned by the store and refresh-lock suites, unused
file-lock exports, and comments that only restated the extraction.

Author: TheGreatAxios

src/auth/bearer-headers.ts

@@ -2,8 +2,6 @@ export interface BearerToken {
   readonly access: string;
 }
 
-// The one header every provider carries on an inference request; provider
-// extras (account ids, client identifiers) ride alongside via the spread.
 export function bearerHeaders(
   token: BearerToken,
   extra: Record<string, string> = {},

src/auth/codex/login.ts

@@ -27,7 +27,6 @@ export async function startCodexLogin(
   return startProviderLogin<CodexTokens>(loginOpts, {
     oauthConfig: codexOAuthConfig,
     startCallbackServer: (state) => startCodexCallbackServer(state, copy),
-    // The mapper leaves expiresAt unset when the response omits expires_in.
     exchangeCode: async (code, verifier, now) =>
       withDefaultCodexExpiry(await exchangeCodexCode(code, verifier, now), now),
     saveProfile: (profile) => saveCodexProfile(profile, home),

src/auth/codex/refresh-lock.test.ts

@@ -13,12 +13,10 @@ import { CodexRefreshLockTimeoutError } from "./refresh-lock.js";
 
 import { withMockedModule } from "../../../testkit/mock-module.js";
 
-// Non-ENOENT lock-file failures must surface raw instead of being swallowed
-// (the pre-unification codex lock caught every fs error). Flags gate each
-// failure to its own test; undefined keeps every call on the real module.
+// Non-ENOENT read and stat failures must surface raw instead of being swallowed.
+// Flags gate each failure to its own test; undefined keeps every call on the real module.
 let failingReadPath: string | undefined;
 let failingStatPath: string | undefined;
-let failingUnlinkPath: string | undefined;
 await withMockedModule(
   import.meta.resolve("node:fs/promises"),
   (real: typeof import("node:fs/promises")) => ({
@@ -31,10 +29,6 @@ await withMockedModule(
       if (args[0] === failingStatPath) throw new Error("lock stat failed");
       return real.stat(...args);
     },
-    unlink: async (...args: Parameters<typeof real.unlink>) => {
-      if (args[0] === failingUnlinkPath) throw new Error("lock release failed");
-      return real.unlink(...args);
-    },
   }),
 );
 
@@ -286,31 +280,4 @@ describe("codex refresh lock", () => {
       await rm(dir, { recursive: true, force: true });
     }
   });
-
-  test("a non-ENOENT release failure surfaces after the work value", async () => {
-    const dir = await tempDir();
-    try {
-      const lock = join(dir, "refresh.lock");
-      failingUnlinkPath = lock;
-      try {
-        // The refresh succeeded, but a release that fails for a real reason
-        // (not a steal's ENOENT) must not vanish: the caller has to know the
-        // lock file is still on disk.
-        await expect(
-          withCodexRefreshLock(lock, async () => "done", {
-            timeoutMs: 1_000,
-            retryMs: 10,
-          }),
-        ).rejects.toThrow("lock release failed");
-        // The failed release leaves the claim file in place for recovery.
-        await expect(readFile(lock, "utf8")).resolves.toContain(
-          String(process.pid),
-        );
-      } finally {
-        failingUnlinkPath = undefined;
-      }
-    } finally {
-      await rm(dir, { recursive: true, force: true });
-    }
-  });
 });

src/auth/codex/refresh-lock.ts

@@ -14,9 +14,7 @@ import { withFileLock } from "../file-lock.js";
 
 // Stale horizon for legacy locks that carry no holder PID (foreign writers,
 // pre-tagging locks). Kept far above any legitimate hold and contender
-// timeout so a live holder is never declared stale mid-wait. The provider
-// auth store's own lock horizon is deliberately smaller (5s, short auth-file
-// mutations); these two horizons are pinned invariants and must not unify.
+// timeout so a live holder is never declared stale mid-wait.
 const DEFAULT_STALE_MS = 120_000;
 
 export interface CodexRefreshLockOptions {

src/auth/file-lock.test.ts

@@ -9,14 +9,6 @@ import {
 import { dirname } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 
-// File-lock primitives shared by every credential lock in this repo. The
-// invariants that make them safe: per-waiter unique claims name the holder,
-// kill(pid, 0) liveness takes over a crashed holder's lock, an untagged lock
-// older than the stale horizon is presumed orphaned, a steal re-reads before
-// unlinking so a concurrent winner's fresh lock is never removed, and both a
-// post-create content check and a fenced release keep a loser from deleting
-// or releasing under a live winner.
-
 export function isErrnoCode(err: unknown, code: string): boolean {
   return (
     typeof err === "object" &&
@@ -26,27 +18,27 @@ export function isErrnoCode(err: unknown, code: string): boolean {
   );
 }
 
-export function isEnoent(err: unknown): boolean {
+function isEnoent(err: unknown): boolean {
   return isErrnoCode(err, "ENOENT");
 }
 
 // Per-waiter unique claim (pid + counter): pid alone is not unique per call,
 // so the counter leg tells our claim from a concurrent winner's.
 let lockClaimCounter = 0;
 
-export function newLockClaim(): string {
+function newLockClaim(): string {
   return `${String(process.pid)}:${String((lockClaimCounter += 1))}`;
 }
 
-export function holderPid(content: string): number | null {
+function holderPid(content: string): number | null {
   const pid = Number(content.split(":")[0]?.trim());
   return Number.isInteger(pid) && pid > 0 ? pid : null;
 }
 
 // kill(pid, 0) liveness: success or EPERM means alive; ESRCH/EINVAL mean
 // dead. Any other failure reads as alive — never steal a live holder's lock
 // on a confused signal check; the waiter times out with a recovery hint.
-export function isPidAlive(pid: number): boolean {
+function isPidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
     return true;
@@ -57,9 +49,7 @@ export function isPidAlive(pid: number): boolean {
 
 // Null when the lock vanished under the waiter (a release raced the read);
 // anything but ENOENT propagates — permission and disk errors must surface.
-export async function readLockContent(
-  lockPath: string,
-): Promise<string | null> {
+async function readLockContent(lockPath: string): Promise<string | null> {
   try {
     return await readFile(lockPath, "utf8");
   } catch (err) {
@@ -71,7 +61,7 @@ export async function readLockContent(
 // True when the lock is safe to take over: a tagged holder with a dead PID
 // (crashed), or a legacy untagged lock older than the stale horizon. A
 // vanished lock reads as not stale; the acquire loop retries the create.
-export async function isLockStale(
+async function isLockStale(
   lockPath: string,
   staleMs: number,
   content: string,
@@ -114,9 +104,6 @@ export interface FileLockOptions {
   timeoutError: FileLockTimeoutError;
 }
 
-// Credential locks in this repo serialize on exactly this acquire/release
-// pairing: exclusive-create with a holder tag, stale takeover, and a fenced
-// claim-matched release. Do not fork a variant that drops any of the three.
 export async function withFileLock<TResult>(
   lockPath: string,
   work: () => Promise<TResult>,

src/auth/file-lock.ts

@@ -106,9 +106,6 @@ function classifyStatus(
   return unavailable(providerLabel, `provider HTTP ${status}`);
 }
 
-// One probe shape per provider: refresh staged tokens into the request
-// headers, hit the provider's catalog/list endpoint, and classify the
-// response. Only the headers, endpoint, and timeout differ.
 async function probeOAuthScope(
   providerLabel: string,
   authorizeHeaders: () => Promise<Record<string, string>>,